Podcast Generation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:47 AM UTC
• Version: 1.0.19

Overview

This skill is a coherent CellCog podcast-production helper, with disclosed API-key use and output-file creation, but users should be mindful of unpinned install commands.

Install this only if you trust CellCog and are comfortable using a CELLCOG_API_KEY with its service. Prefer a pinned or reviewed package version where possible, use a virtual environment or isolated workspace for pip installs, and review generated MP3 and chapters.json files before publishing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:369

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 369-371
Vulnerability Type: Unpinned and remotely resolved third-party dependencies
Risk Level: Medium

Vulnerable Code:

text

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The installation instructions resolve and install third-party components without specifying a reviewed version, immutable commit, package hash, lockfile, or signature verification requirement. In particular, pip install -U cellcog explicitly requests the newest available package, while the npx and OpenClaw installation commands similarly lack immutable version constraints.

Consequently, the code installed when a user follows these instructions can differ from the dependency version that existed when this Skill was audited. If a package registry account, source repository, release pipeline, or upstream dependency is compromised, a malicious release could be distributed through these otherwise legitimate commands. Package installation hooks, imported initialization code, or subsequently invoked Skill logic could then execute attacker-controlled code locally.

The project does not itself contain an embedded malicious payload, and the audit found no evidence that the named packages are currently malicious. The vulnerability is the absence of controls that bind installation to a known and reviewed artifact.

Attack Path

1. An attacker compromises an upstream package publisher account, repository, release process, or transitive dependency.
2. The attacker publishes a malicious version under the package identifiers referenced by the doc ...[truncated 1170 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed, exact version rather than requesting the latest release.
2. For repository-based installation, use an immutable commit hash instead of a mutable branch or tag.
3. Use lockfiles and package-manager integrity controls where supported.
4. For Python dependencies, distribute a requirements file containing exact versions and cryptographic hashes, and install it with pip install --require-hashes -r requirements.txt.
5. Document the authoritative registry and publisher identity for each package.
6. Verify package signatures, provenance attestations, or published checksums before installation.
7. Review and pin transitive dependencies, not only the top-level cellcog package.
8. Perform installation in a least-privileged virtual environment or isolated container, and do not expose API keys during dependency installation.
9. Establish an update process in which newer versions are reviewed and tested before the documented pins are changed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning a specific package or version. This can cause users to fetch and execute whatever package version is current at install time, increasing supply-chain risk if the upstream package is compromised, typosquatted, or updated maliciously.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The markdown describes that the skill generates a ready-to-publish MP3 and a chapters.json output, which affects user data/workspace by creating files. However, it presents these outputs as capabilities without any explicit warning or note that files will be written or where they will appear.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.